Between April and July, AOMEI Backupper served malware to its users multiple times in short-burst supply chain compromises, security researchers warn.
AOMEI Backupper is Windows backup, sync, and disk cloning software, available in free and paid editions for home users, businesses, and Windows Server environments. AOMEI says its products are used by more than 186 million people worldwide.
Unlike typical supply chain attacks, this campaign relied on short-lived tampering windows to serve the CrossRoad downloader and the ShinyRoad backdoor.
“Each tampering window remained active for only five to ten minutes before reverting to authentic versions,” report Google Cloud’s Google Threat Intelligence Group (GTIG) and Mandiant, which investigated the attack alongside ManageEngine Threat Analysis Lab (METAL).
The attacks hit all systems that fetched the modified AOMEI Backupper packages during the attack windows, suggesting an opportunistic campaign rather than a targeted one.
However, throughout the investigation, Google Cloud identified higher education, IT services, and telecommunications entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the United States that have been compromised.
“We confirmed several tampering windows in 2026, alongside related malware samples observed in the wild starting in late April. However, given the short duration of these windows, it is probable that additional tampering occurred throughout the campaign that remained outside our visibility,” Google Cloud notes.
During the very short attack windows, the threat actor, tracked as UNC7017, tampered with the update server’s update settings file to redirect to a malicious ZIP archive and modified the server’s automatic notification service to force systems into automatically executing the malware.
METAL’s analysis of the incident shows that the hackers abused AOMEI Backupper’s promotional content channel for malware distribution. The channel runs background services that poll AOMEI’s servers for content and includes two configuration paths that deliver content to a directory and execute it.
“The two paths converge on the same location. One controls what lands in html\; the other controls what can be executed from it. Neither configuration file is cryptographically authenticated by the client, and the checksum used to validate the archive is declared inside the same unauthenticated file that names it,” METAL explains.
ManageEngine’s threat analysts caught a glimpse of the potential attack path on May 28, and observed in real time the change in payloads served by AOMEI on July 16. On July 20, the short-burst tampering was also caught by Mandiant.
Analysis of the payload showed the delivery of a legitimate version of the Radmin Server remote administration tool alongside a malicious DLL loaded through it that would establish a reverse TCP connection to the attackers’ command-and-control (C&C) server.
Google Cloud’s researchers also observed UNC7017 introducing a secondary exploitation vector, replacing a legitimate banner with a 1×1 pixel window assigned maximum execution priority that forced the AOMEI client to request a remote resource via WebDAV, thus sending NetNTLMv2 authentication hashes to the attackers.
Throughout the various stages of the campaign, the threat actor delivered multiple payloads, including the CrossRoad dropper, a modified version of Radmin Server, and the Adaptix C&C framework.
CrossRoad was seen performing system validation, cleanup, and payload staging, establishing persistence for the late-stage backdoor, and deleting itself from the disk. The final payload was the ShinyRoad modular backdoor framework.
In July, after the successful deployment of ShinyRoad, UNC7017 was seen dropping AdaptAgent, which is part of the Adaptix C2 post-exploitation framework.
“This campaign highlights a broader evolution in software supply chain attack methodologies. Supply chain intrusions have historically focused on inserting backdoors into software source code or tampering with developer build pipelines. UNC7017’s use of ephemeral configuration tampering represents a lower-overhead, higher-stealth alternative,” Google Cloud notes.
METAL says it initially notified AOMEI Technology of the potential tampering in early June, but the vendor dismissed the report, claiming the content was likely intercepted and modified in transit. Google Cloud notified it again in mid-July, and the company said in late July that it had taken corrective actions.
Related: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Related: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Related: ConnectWise Suspends Cloud Services in Response to Cyberattack
Related: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
